5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-23829

CVE-2026-23829: Mailpit has SMTP Header Injection via Regex Bypass

Mailpit is an email testing tool and API for developers. Prior to version 1.28.3, Mailpit's SMTP server is vulnerable to Header Injection due to an insufficient Regular Expression used to validate RCPT TO and MAIL FROM addresses. An attacker can inject arbitrary SMTP headers (or corrupt existing ones) by including carriage return characters (\r) in the email address. This header injection occurs because the regex intended to filter control characters fails to exclude \r and \n when used inside a character class. Version 1.28.3 fixes this issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-23829

CVE-2026-23829:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/axllent/mailpit	go	<= 1.28.2	1.28.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an SMTP header injection flaw in Mailpit's smtpd server. The root cause lies in the smtpd.session.serve function, which inadequately validated email addresses from MAIL FROM and RCPT TO commands. The regular expression used, [^<>\v], incorrectly allowed control characters, specifically carriage returns (\r), within the address.

An attacker could exploit this by sending an SMTP command with a crafted address, such as RCPT TO:<victim\rX-Injected-Header: value>. The serve function would accept this malicious address.

Subsequently, when the email data is being processed, the serve function calls smtpd.session.makeHeaders to generate the Received header. The makeHeaders function takes the tainted recipient address and inserts it directly into the header string, causing the injected header to be written into the raw email file. The patch addresses the vulnerability at the source by introducing a new function, extractAndValidateAddress, which uses the Go standard library's net/mail.ParseAddress for strict RFC-compliant validation, thus preventing any control characters from being accepted in the email address.

Vulnerable functions

smtpd.session.serve

internal/smtpd/smtpd.go

This function is the main loop for handling SMTP commands. It used a flawed regular expression (`mailFromRE` and `rcptToRE`) to parse and validate `MAIL FROM` and `RCPT TO` parameters. The regex allowed control characters like carriage return (`\r`) to be present in the email address, which were then stored and passed to other functions. The patch replaces the direct regex matching with a call to a new, more secure validation function.

smtpd.session.makeHeaders

internal/smtpd/smtpd.go

This function constructs the `Received` email header. It uses the recipient address (`to[0]`) directly in a `fmt.Sprintf` call without any sanitization. If the address, validated incorrectly by the `serve` function, contains a carriage return, it leads to SMTP header injection when the header is written to the email data.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.